Labs / Active Directory, defender view
One password, eleven accounts
Read Kerberos pre-authentication failures (4771) on a domain controller, recognise a password spray by its shape, and find which sprayed accounts then received a TGT.
Briefing
A spray tries one common password against many accounts, slowly enough not to lock any of them out. On a DC it shows up as 4771 events with failure code 0x18 (bad password) for many names from one address.
After the failures, look for 4768 events from the same address with result code 0x0: those accounts gave up the password.
DC-01 · Active Directory, defender view
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.